Exchange is expected to be used by mongos communicating with mongod instances.
Some code paths "trust" the contents of this as-if it were from a validated source i.e., there are invariants on the contents. This means external clients are able to crash mongod by supplying unexpected exchange state.
Invariants are being investigated and changed individually, but over all exchange should not be part of the attack surface of mongod.
- related to
-
SERVER-126803 Use internal client+writeConcern in exchange_keyrange_maxkey.js
-
- In Code Review
-
-
SERVER-126978 Temporarily exclude test in multiversion setup
-
- Closed
-